[pre-commit.ci] pre-commit autoupdate

[pre-commit-ci]

updates:

• github.com/astral-sh/ruff-pre-commit: v0.14.10 → v0.14.11
• github.com/woodruffw/zizmor-pre-commit: v1.19.0 → v1.20.0
• github.com/RobertCraigie/pyright-python: v1.1.407 → v1.1.408

[Pierre-Sassoulas]

Executed locally, the zizmor issue is "action is not pinned to a hash (required by blanket policy)" * 20

[bluetech]

Executed locally, the zizmor issue is "action is not pinned to a hash (required by blanket policy)" * 20

I think we should fix it, it's good to pin with hashes, and dependabot supports updating the pin so it shouldn't be a maintenance headache AFAIK. I will look into pushing the pins to this PR in a bit unless you beat me to it :)

[webknjaz]

dependabot supports updating the pin so it shouldn't be a maintenance headache AFAIK

Make sure to leave # v1.0.0 comments matching the commits in your PR. Dependabot updates such comments with actual tags when in offers bumps. But I think this might get out-of-sync if the version in comment doesn't match the hash at the time of the dependabot run.

[Pierre-Sassoulas]

I did that and also fixed the zizmor output in bd1ef86

[bluetech]

Nice!